EmailFirst sends business-to-business email campaigns to decision makers at UK limited companies. This page sets out the legal basis for that activity and the safeguards we apply to every campaign.
1. The rules that apply
Business email marketing in the UK is governed by two sets of rules that work together:
- The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which determine whether an electronic marketing message may be sent and what it must contain.
- The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which govern the use of personal data, such as a named individual's business email address.
Both were amended by the Data (Use and Access) Act 2025. We keep our approach under review as the Information Commissioner's Office (ICO) updates its guidance.
2. PECR and corporate subscribers
PECR distinguishes between individual subscribers and corporate subscribers. The requirement for prior consent to receive marketing email, in regulation 22, applies to individual subscribers. It does not apply to corporate subscribers.
Corporate subscribers include limited companies, limited liability partnerships, Scottish partnerships and government bodies. Marketing email may therefore be sent to people at these organisations without prior consent, provided the sender is identified and a valid address for opting out is given, as required by regulation 23.
Sole traders and ordinary partnerships in England, Wales and Northern Ireland are treated as individual subscribers. We do not send campaigns to sole traders or non-limited partnerships. Our campaigns go only to people at limited companies and other corporate bodies.
3. UK GDPR and legitimate interests
Where a business email address identifies an individual, it is personal data, and a lawful basis is required to use it. Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. The Data (Use and Access) Act 2025 confirms in the legislation that direct marketing is an example of processing that may be carried out for a legitimate interest.
Relying on legitimate interests requires a three-part assessment, which we have carried out and keep under review:
- Purpose. Introducing relevant products and services to businesses is a legitimate commercial interest, both for us and for the clients whose offers we promote.
- Necessity. Contacting the person who holds the relevant role at a business is a proportionate and targeted way to achieve that purpose. We use only the business contact information needed to do so.
- Balance. The communication is sent to a professional in their business capacity, about matters relevant to their role, at a business address. People in these roles can reasonably expect to receive relevant business approaches, the impact on them is minimal, and they can opt out at any time with a single click.
4. Our safeguards
Every campaign we run follows these rules:
- Recipients are selected for relevance to their role and to the offer being made.
- Contacts are limited to people at limited companies and other corporate bodies.
- Business contact data is obtained from commercial data providers and public business sources, and is checked and cleaned regularly.
- Every email clearly identifies the business on whose behalf it is sent.
- Every email contains a working opt-out, and opt-outs are actioned immediately.
- Opt-outs are added to a central suppression list that applies across all campaigns, so a person who opts out is not contacted again by any campaign we run.
- Subject lines and sender details are never misleading.
- Recipients can find out how their data is used through our Privacy Policy.
5. Your right to object
Anyone may object to receiving direct marketing at any time, and that right is absolute. To stop receiving emails from campaigns we run, use the opt-out link in any email. You can also ask us to stop using your data, or exercise any of your other data protection rights, by writing to us at the address below.
If you have a concern about a campaign, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. Contact
Emailfirst Limited, Eastham Hall, Eastham, Cheshire, CH62 0AF. Registered in England and Wales, company number 14162647.
This page summarises our approach to the law as it applies to business email. It is provided for information and does not constitute legal advice.