⚖Whom may I write to?

In principle no — not even in business dealings. § 7 of the German Act against Unfair Competition (UWG) treats advertising by email without prior express consent as an unreasonable nuisance, regardless of whether the recipient is a consumer or a company.

This is the rule most often ignored in practice. It applies all the same.

There are two exceptions:

1. Existing customers under strict conditions (§ 7 (3) UWG).
2. Express consent — that can be proven.

What does not count as consent: an address published on a website, an exchange of business cards, an enquiry about a different topic, a contact on a professional network.

The difference between consumers and companies lies not in the permission but in the level of risk: with companies, competitors send formal warnings (Abmahnungen); with consumers, associations do too.

It must have four properties:

• Freely given. Not a condition for something else.
• For the specific case. “Advertising” in general is not enough; it must be clear who is writing about what.
• Informed. The recipient must know what they are agreeing to.
• Unambiguous. An active action — a tick you set yourself, not one that is already set.

And it must be provable: when, from which address, with which text. Hence the double opt-in procedure — the confirmation mail is the proof.

What this means in everyday work: consent comes about when it is collected, not when sending. Anyone who has not documented it cannot reconstruct it later.

And it expires: consent that has not been used for years is, according to a widely held view, no longer valid.

§ 7 (3) UWG allows advertising to existing customers without separate consent — but only if all four conditions are met:

1. You obtained the address in connection with a sale.
2. You advertise your own, similar goods or services.
3. The customer has not objected.
4. They were clearly informed of their right to object when the address was collected and with every use.

Point 2 is where it usually fails: “similar” is to be interpreted narrowly. Anyone who has sold a heating system may advertise maintenance — not a kitchen.

Point 4 is also often overlooked: the notice must have been given at the time of purchase, not only in the promotional mail.

If you are unsure whether a contact is an existing customer in this sense: they usually are not.

Two questions need to be kept apart, and both must be answered:

Data protection (GDPR, in German DSGVO): may I process the data at all? Publicly accessible business addresses can usually be based on legitimate interest — with a duty to inform the data subject.

Competition law (UWG): may I use this address for advertising by email? Here the consent requirement applies — regardless of how legally you obtained the address.

From this follows the most important sentence in this chapter: a legally obtained address does not entitle you to send advertising.

What works in practice: use addresses for research and preparation, then make contact by another route — phone, post, a network. And ask there for consent to emails.

Bought address lists are almost always a problem: the consent claimed there can rarely be proven, and in case of doubt you are liable.

With consumers: no, without prior express consent. That is clear-cut and strictly enforced.

With companies, presumed consent is sufficient — that is, an objective reason to assume the call is welcome. That is a lower hurdle than with email, but not a free pass:

• A connection with the business of the person called must be recognisable.
• A call to a painting business about painting supplies: rather yes.
• A call to the same business about insurance: rather no.

That is why the Phone is often the better first contact in practice than email: the hurdle is lower, and if the conversation goes well, you have consent for everything that follows.

Record what you base the assumption on — in case of doubt you must be able to justify it.

Advertising by letter is considerably freer than email or phone: it is permitted in principle as long as there is no objection.

That makes post an underestimated route — precisely because hardly anyone uses it any more.

What you must bear in mind:

• Respect objections. Anyone who objects in writing may not receive any more post.
• Data protection still applies. You are processing personal data and must inform people about it.
• Take Robinson lists (opt-out registers) into account where you write to consumers.

For Aurora Hive Sales this means in practice: your records and categories help just as much in preparing a postal mailing — only the sending itself happens outside.

Act on it immediately — and completely, not just for the one campaign.

Specifically:

1. Set the opt-out on the contact. That removes them from every future mailing.
2. Confirm, briefly and without any follow-up question. No “Are you sure?” and no attempt to change their mind.
3. Do not delete. You need the entry to be able to prove that you respected the objection — a deleted address ends up back in the list with the next import.

An objection is valid without any formal requirements: by email, on the phone, orally. It does not have to come via the unsubscribe link, and it does not need to be justified.

And it applies permanently until the person themselves says otherwise. Ignoring it after a year because “that is long ago” is an infringement.

Then you must tell them — within one month, completely and free of charge (Art. 15 GDPR).

What you must disclose:

• Which data you have stored about the person.
• Where it comes from.
• What you process it for and on which legal basis.
• How long you keep it.
• Who else receives it.
• The person’s rights, including the right to complain.

This is the point at which documenting the origin pays off. If you record for every contact where it comes from, the answer is a matter of minutes. If not, it is a matter of days, and the answer “we do not know” is itself an infringement.

A request for access is often followed by a request for erasure. Expect it.

Not everything — but everything for which there is no longer a reason.

To be deleted: everything you stored only for advertising and outreach. Notes, history, additional details.

To be kept, partly mandatory:

• A blocking note with the address — precisely so that the person is not written to again after the next import. That does not contradict the erasure; it is how it is carried out.
• Data from a business relationship to which commercial or tax retention periods apply. Invoices are not deleted.

Reply within one month and say what you have deleted and what remains for which reason. A justified partial refusal is permitted; silence is not.

In this order:

1. Note the deadline. It is short and meant seriously.
2. Sign nothing. The enclosed cease-and-desist declaration is regularly drawn too broadly and applies indefinitely with a contractual penalty.
3. Secure the facts. Which mail, to whom, when, on what basis. Do not delete the campaign and the recipient list — you need them for your defence.
4. Stop sending to this person immediately.
5. Bring in a solicitor specialising in competition law.

What you should not do: call the party who sent the warning and argue. And do not let the campaign quietly carry on — every further mail makes the situation worse.

At the same time, check whether the same basis is also missing for other recipients. A formal warning usually points to a pattern, not an isolated case.

Yes — with every service that processes personal data on your behalf. For a CRM, that is the norm.

Who this concerns:

• The operator of your Aurora Hive Sales instance.
• The mail delivery service, if an external service is used.
• AI services, insofar as contact data goes to them.
• Search services, if they are fed with personal details.

What must be in the agreement is laid down in Art. 28 GDPR: subject matter, duration, nature and purpose, obligation to follow instructions, confidentiality, technical measures, sub-processors, deletion at the end.

Aurora Hive Sales generates a data processing agreement (AVV) for you from your master data. That is the agreement between you and your customers when you yourself act as a processor — you get the agreement with your operator from them.

In most cases, yes. The much-quoted exemption for businesses with fewer than 250 employees does not apply if the processing is not merely occasional, and a CRM with ongoing contact management is exactly that.

What belongs in it is manageable:

• Who is responsible.
• Which processing activities there are (contact management, promotional mailings, applications …).
• Purposes and legal bases.
• Categories of data subjects and data.
• Recipients.
• Deletion periods.
• Technical and organisational measures.

That is a table with a few rows, not a doctoral thesis. It must exist and be up to date — you only have to present it at the request of the supervisory authority.

Yes. Art. 14 GDPR requires this if you have not collected the data from the person themselves — that is, with every piece of research, every address purchase, every import from a directory.

The deadline: within one month, but at the latest with the first contact.

In practice this means: the first mail or the first letter should contain a section that says

• who you are,
• which data you have and where it comes from,
• what you process it for and on what basis,
• for how long,
• which rights the person has.

This can be done as a short paragraph with a reference to your privacy notice. It costs four lines and closes one of the most common gaps.

Not with more mails, but with a different way in:

1. Phone first. The hurdle is lower in business dealings, and one conversation achieves more than twenty mails.
2. Collect consent where people are anyway — on the website, at appointments, at trade fairs, after an order.
3. Look after existing customers instead of writing to strangers. The cheapest revenue is from someone who has already bought.
4. Be visible, so that people enquire of their own accord. An enquiry via the website is an invitation to reply.
5. Post and personal contact for the cases where it is worthwhile.

The common denominator: you build up a base of people who have agreed. That takes longer and lasts for years — whereas a cold list works once and is burnt afterwards.

The business — always, towards the outside world. Who is responsible internally is another question.

Three practical points follow from this:

• Not everyone needs the right to send. Anyone who maintains contacts does not need to be allowed to set a campaign live. Assign the role according to what someone is meant to do.
• Agreements in writing. Who decides whether a list may be written to? That should be settled before the first time it is urgent.
• The log helps. It shows who triggered what and when — not to assign blame, but to clear up an incident and put a stop to it.

And the most effective precaution: the brake that asks for confirmation when no audience has been chosen. It exists because exactly this mistake once happened.