1. Why this document exists

GoSales is established in Ireland, so the GDPR and the Irish ePrivacy Regulations (S.I. 336/2011) apply to everything we do with personal data. Our supervisory authority is the Data Protection Commission. Where we handle data about people in the UK, the UK GDPR and PECR apply as well, overseen by the Information Commissioner’s Office.

These guidelines tell the team what to do in practice. They are not a legal opinion. Anything published externally, and any client contract with a data protection clause, needs review by a solicitor before it is signed or goes live.

2. Two roles, two sets of obligations

This is the distinction the team gets wrong most often, and it determines who is accountable for what.

We are a controller when we decide why and how data is processed. This covers our own website visitors, our own outbound prospecting, our employees and contractors, and our supplier relationships.

We are a processor when a client instructs us to handle data on their behalf — for example, working a territory list for a client or running analysis on data they supply.

3. Lawful bases we rely on

Every processing activity needs one basis under Article 6, chosen before processing starts and recorded.

We do not rely on consent for outbound prospecting, because consent that is not freely given is not valid. Legitimate interest is the correct basis, but it only holds if the assessment behind it is real.

4. The website

Forms

Collect only what the purpose requires. A contact form needs a name, an email address and a message. It does not need a phone number, company size or budget unless we can say why.

At the point of collection, every form must carry: who we are, what we will do with the submission, how long we keep it, and a link to the privacy notice. One line and a link is enough.

Cookies

No non-essential cookie fires before consent. This includes GA4. Practically, that means the consent management platform must block the tag, not merely record a preference after the tag has already loaded. Check this in the browser’s network tab before signing off any deployment — a banner that displays correctly while the tag fires underneath it is a common and expensive failure.

Banner requirements

• Reject must be as prominent and as few clicks as accept
• No pre-ticked boxes, no implied consent from scrolling or continuing to browse
• No cookie wall — the site must work if consent is refused
• Granular by category, not all-or-nothing
• Withdrawal available at any time from the footer
• Log the consent record: timestamp, version of the policy shown, and what was chosen

5. Outbound prospecting

This is our highest-risk processing, because the data comes from third-party sources rather than from the people themselves.

5.1 The legitimate interest assessment

Before a campaign launches, document three things:

1. Purpose — what business interest the outreach serves
2. Necessity — why outreach is a reasonable way to achieve it, and why a less intrusive route would not work
3. Balance — whether the recipient would reasonably expect it, weighed against their interests

Keep this to a page. It must exist before the first send, not be written afterwards to justify a complaint.

5.2 The Article 14 obligation

When we obtain personal data from anywhere other than the person themselves — a data vendor, a scrape, a purchased list — Article 14 requires us to tell them: who we are, what data we hold, where we got it, our lawful basis, how long we keep it, and their rights.

The deadline is a reasonable period and at most one month, or at the time of the first communication if that comes sooner. For us it always comes sooner. So the first outbound email must carry this information or a clear link to it.

A single line in the footer meets this if it is honest and the link works. Burying it does not.

5.3 Electronic marketing rules

The ePrivacy Regulations sit on top of the GDPR and govern the sending itself.

Corporate subscribers in Ireland — companies and their employees at business addresses — may be sent marketing email on an opt-out basis, provided each message carries a working opt-out and we honour it.

Individual subscribers need prior consent, with a narrow exemption for existing customers being marketed similar products.

In the UK, sole traders and most partnerships count as individual subscribers, so consent is required for them. Personal-format addresses and one-person consultancies on a target list need a second look before they are mailed.

Every message must identify GoSales, not disguise who is sending it, and give a valid reply address.

5.4 Suppression

An opt-out or objection is permanent. Maintain one central suppression list, apply it across every tool and every campaign, and never delete a record from it — a suppressed contact must stay suppressed even after the rest of the record is erased. Process objections within days, not at the next campaign build.

6. Tools and vendors

6.1 Before adopting any tool

No tool that will touch personal data goes live until:

1. A data processing agreement is in place (Article 28)
2. The vendor’s sub-processors are known and the list is monitored
3. Where data leaves the EEA, a transfer mechanism exists — adequacy decision, Data Privacy Framework certification, or Standard Contractual Clauses with a transfer impact assessment
4. Retention and deletion behaviour is understood — what happens to our data when we stop paying
5. The default settings have been reviewed, not accepted

Point 5 is the one that bites. Defaults are set for the vendor’s convenience, not our compliance.

6.2 Standing tool policy

The following is in force and is not optional:

• No employee mailbox is connected to Instantly. The platform is used for buying data only, through a dedicated account with account access and no mailbox connection.
• Any sales engagement tool that offers mailbox sync has that feature audited before use, and the audit includes confirming that switching it off actually stops ingestion.
• If a vendor cannot meet these conditions, the data function moves to an alternative.

This exists because an unintended mailbox sync ingested roughly a thousand email conversations containing client and contact personal data, and disabling the setting did not immediately stop it. The lesson generalises: verify that a control works rather than trusting that it does.

6.3 The Instantly visitor pixel — open risk

The Instantly Website Visitors pixel is live on the site. It is not an analytics tool. It matches visitor IP addresses and cookie identifiers against a commercial contact database to resolve anonymous traffic to named individuals, enriches them, and feeds them into outbound campaigns.

This is materially higher risk than GA4 and needs resolving before anything else on the checklist:

• It is a marketing technology, not analytics. It belongs in the marketing consent category and must not fire until marketing consent is given. If it is currently firing on page load with no consent management platform in place, it is operating without a lawful basis under the ePrivacy Regulations.
• Legitimate interest is difficult to sustain here. For ordinary outbound prospecting, legitimate interest is defensible. For covert identification of a person who visited a website and did nothing else, it is much weaker — the balancing test turns on whether the person would reasonably expect it, and most visitors would not expect to be named and emailed because they read a page. Consent is the safer basis, and consent means the pixel does not run for anyone who declines.
• Article 14 applies immediately. Anyone identified this way did not give us their data. The first email must state that we identified them through our website and where the contact details came from. In practice this makes the outreach feel intrusive, which is itself a signal about the balancing test.
• A DPIA is likely required. Systematic monitoring and profiling of individuals at scale is one of the criteria that triggers Article 35. Complete the assessment before relying on the tool, not after.
• Geography matters. Instantly’s identification is oriented toward US visitors, and comparable tools restrict resolution to the US precisely because of GDPR. Establish whether EU and UK visitors are being resolved at person level at all. If they are not, the practical exposure is narrower — but the pixel still sets cookies on every visitor, so the consent obligation stands either way.

Actions

1. Confirm with Instantly whether EU and UK visitors are resolved at individual level
2. Obtain the data processing agreement and the transfer mechanism for the US transfer
3. Establish what the pixel sets and how long it persists
4. Block the pixel behind marketing consent, or pause it until the CMP is live
5. Complete a DPIA before resuming
6. Decide, on the DPIA’s findings, whether to keep the tool at all

This also expands Instantly’s data footprint at GoSales again, which is worth weighing against §6.2.

6.4 Vendor incident escalation

If a vendor mishandles our data: raise a formal request in writing, escalate to their privacy officer, then to their EU representative, then to the Data Protection Commission. Keep the paper trail from the first message — it becomes the evidence if a complaint is filed.

7. Data subject rights

People can ask for access, correction, erasure, restriction, portability, or object to processing. They can also object to direct marketing at any time, and that objection is absolute.

Procedure

1. Log the request the day it arrives, wherever it arrives — a request sent to any employee’s inbox counts, and the clock starts then, not when it reaches the right person
2. Verify identity proportionately; do not demand a passport for a marketing opt-out
3. If we are the processor, forward to the client immediately and do not respond directly
4. Respond within one month; extendable by two further months for complex requests, but the extension must be communicated within the first month
5. Provide the response free of charge in the ordinary case
6. Record what was asked, what we did and when

Every employee should be able to recognise a request. It will rarely say “Article 15” — it will say “what do you have about me” or “take me off your list”.

8. Retention

Keeping data indefinitely is a breach of the storage limitation principle. Set a period per category and enforce it.

Review annually. Automate deletion where the tool supports it; where it does not, put a recurring calendar task against a named owner.

9. Security

• Multi-factor authentication on every account holding personal data
• Access on a need-to-know basis, reviewed when anyone changes role and revoked the day anyone leaves
• No client or prospect data in personal accounts, personal devices or personal cloud storage
• No exports to a local machine without a reason and a deletion date
• Encryption in transit and at rest
• Personal data does not go into a public or unvetted AI tool

10. Breach response

A personal data breach includes accidental disclosure and loss of access, not just malicious attack. The unintended mailbox sync in §6.2 was a notifiable-category event and should be treated as the reference example.

11. Records of processing

Article 30 requires a record of our processing activities. Maintain a single register listing, for each activity: the purpose, the categories of people and data, the lawful basis, recipients and sub-processors, transfers outside the EEA, retention period, and security measures.

Update it when a new tool, campaign or client engagement starts. This is the first document a regulator asks for.

12. Governance

• These guidelines are reviewed annually and whenever a new tool or data source is introduced
• Every new employee and contractor reads them during onboarding and confirms it
• We do not currently appoint a statutory Data Protection Officer; if our processing becomes large-scale or systematic monitoring, that assessment must be redone

Owner of this document: [name]