Data in outreach projects

Who determines the purpose

SIA FLEXLAB is a controller when it independently determines purposes and datasets for its own promotion. In a client project, the actual activities determine whether we are a processor following instructions, an independent controller or a joint controller. A contract label does not replace this assessment.

Agree the purpose, audience, sources, access and transfer terms before using a list. Processing for a client requires GDPR Article 28 terms; jointly determined purposes require an Article 26 allocation of responsibilities.

Contact sources

Possible sources include the client, earlier business enquiries, company websites, public registers and professional directories. The source and collection date must be traceable for each contact. A generic reference to the public internet is insufficient.

Named work emails, roles, phone numbers and correspondence may be personal data. Public availability and B2B use do not remove data protection obligations. An industry directory containing such fields is not anonymous.

Basis for contact

Each campaign requires assessment of the recipient’s country, type, channel and electronic marketing rules. GDPR legitimate interest does not itself permit an email where consent is legally required.

Where legitimate interests apply, document the purpose, necessity and balancing assessment. Where consent is required, record its source and scope. Relevance of an offer does not replace these requirements.

Informācijas sabiedrības pakalpojumu likums · GDPR

Information for recipients

The first contact should identify the sender, the business represented, the reason for contact and a simple objection method. For indirectly obtained data, provide Article 14 information, including categories and source, normally no later than first contact or one month after collection.

Recipients may ask what data is used, where it came from and who received it. Campaign results go to the agreed client to the extent needed to continue the business conversation.

How to object

Reply to the email asking for no further contact, use its unsubscribe link where provided, or email vladimir@fevralov.com. Identify the recipient address; no reason is required.

A minimal suppression record is needed to avoid contacting you again: an address or matchable identifier, date and scope of objection. It is used for exclusion, not further marketing. A hashed email address is not automatically anonymous.

At project completion

The intended closure process is to deliver the agreed result, confirm receipt and remove working copies and temporary exports within the agreed period. Mailboxes, archives, backups and provider-held copies must be covered separately. Deleting the main table does not prove all copies are gone.

Exceptions need a specific basis: mandatory documents, legal claims and minimal suppression records. Industry insights can be separated from contact data only after people can no longer be identified. This page does not claim automatic cleanup across all client systems.