Sending policy, and what we refuse to do.

1. Businesses only — and how that is enforced

ADM exists to help one business start a conversation with another. The people we contact are approached because of the job they do: a facility manager about cleaning supplies, an operations director about logistics. We are not interested in them as private consumers and we do not use ADM to reach them as one.

That is a policy, so the product checks it rather than trusting it. Before a campaign sends, ADM classifies every recipient address:

• Company mailbox — a named person on their employer's domain. The normal case.
• Generic company mailbox — info@, sales@, contact@. Usually not personal data at all, because no identified individual sits behind it. These are the lowest-risk contacts we hold, not the highest.
• Personal mailbox — a free webmail domain such as gmail.com, gmx.de or hotmail.nl. Most likely a private individual.

Personal mailboxes are counted, listed and reported back to whoever is about to send, with the reason. Legitimate interest is at its weakest against a private subscriber: every EU country applies the strict consent rule to natural persons, and none of them has discretion to soften it. A one-person firm genuinely running on webmail is a real thing and the product does not pretend otherwise — but the person sending has to look at the list and decide, rather than find out afterwards.

2. What ADM will not be used for

These are contractual prohibitions in our terms, not aspirations:

• No consumer marketing. Private individuals, in their private capacity, are out of scope for this product entirely.
• No purchased consumer lists. Ever, in any market, with or without a claimed consent record attached to them.
• No sending to someone who has opted out. Suppression is enforced in the sending code, not in a setting. It cannot be turned off, and it cannot be bypassed by re-importing the same address.
• No impersonation. Not of another company, not of a person who did not write the email, and not through a sending domain the customer does not control.
• No disguising what the message is. Every email identifies the sending organisation, carries a real postal address, and says plainly that it is outreach.
• No harvesting for resale. One customer's contacts are never used to generate leads for another, and we do not sell, rent or share contact data.

Accounts that breach these are suspended. We would rather lose the subscription than the sending reputation of every other customer on the platform.

3. Where the contact data comes from

None of it comes from the people themselves. That matters legally — it is why Art. 14 GDPR applies and why the first email has to say so — and it is the fact most outreach tools quietly avoid putting in writing.

We do not collect special category data, we do not build behavioural profiles of individuals, and we do not enrich business contacts with anything from their private life. The data we hold about a recipient is what you would find on their business card plus a description of their employer.

Verified, and one per company. On lead generation we only keep contacts whose address is verified at source, and only one contact per company — so the same organisation is not approached four times by four people who each think they are first.

4. Why this is lawful, and where it is not enough

The lawful basis for B2B outreach on ADM is legitimate interests, GDPR Art. 6(1)(f). That is a real basis, not a loophole, but it only holds if the three-part test actually passes — so here it is, stated rather than assumed:

The interest

Offering a business service to organisations with a plausible need for it. Recital 47 names direct marketing as capable of being a legitimate interest.

Necessity

Contacting the person responsible for that area is how a business conversation starts. There is no less intrusive way to reach a specific decision-maker at a specific company.

The balance

This is the part that does the work, and it is why the rest of this policy exists. The balance tips our way only when the contact is approached at work, about work, with a message relevant to their actual role, from an identified sender, with the source of their data disclosed and an immediate way to stop. Remove any one of those and the balance fails — which is precisely why they are product behaviour rather than good intentions.

Where it is not enough. Legitimate interest under the GDPR is only half the question. The ePrivacy Directive governs the act of sending, and several countries used Art. 13(5) to require prior consent for business recipients too. In those markets a legitimate-interest argument and a working unsubscribe link do not make the send lawful on their own. See the table below.

5. The country rules we apply

ADM classifies every recipient by country and tells the sender which regime applies before the campaign goes out. This is the table the product uses:

Two deliberate design choices in that classification. A country we cannot recognise is treated as strict, never as permissive — the safe failure is to over-warn about a market we know little about. And the warning is shown to the person sending and written to an audit record, because a warning that is displayed and not recorded proves only that someone knew, with nothing to show what they weighed.

This classification is our operating position and is kept under review with counsel per market. It is not legal advice to our customers, who remain responsible for the lawfulness of their own sending.

6. Targeted, not bulk

"Bulk email" usually means one message duplicated across a list. That is not what ADM produces, and the distinction is not cosmetic — a message genuinely relevant to the recipient's job is the thing that makes the balancing test in section 4 pass.

• Each email is written from scratch for one recipient. Not a template with a merge field. The recipient's role, their employer, what that company does, and anything already exchanged with them all go into the writing.
• Each lead carries its own reason for being contacted. Research on the company produces a specific angle — why this business, now — and that angle leads the email rather than decorating it. Two recipients in one campaign get materially different emails, because the reason to contact them is different.
• A person can write it instead. Any campaign can be sent with copy written by hand, with no model involved in the body at all. Customers who find generated copy insufficiently personal use this, and it is available on every plan.
• Nothing sends by itself. Generated leads arrive in a review queue and every campaign is previewed before launch. There is no mode in which ADM finds people and emails them without a human in between.

Generated copy is drafted by third-party language models under contract. What is sent to them is the recipient's name, company, country, role and the campaign brief — never payment data, never credentials, and never a customer's full contact list. Providers are named in our sub-processor list, and none of them may train on what we send.

7. What the product does before you press send

Compliance that lives in a policy document gets read once. These are the checks in the running system:

Only the first of those blocks a send. The rest inform and record, because the person running the campaign knows things the classifier does not — whether a webmail address belongs to a sole trader they have already met, whether consent is held for a German recipient. What the product guarantees is that they decide with the facts in front of them, and that the decision is written down.

8. If you received an email and want it to stop

Use the unsubscribe link in the email. It is one click, it needs no account and no reply, and it takes effect immediately and permanently across every campaign on the platform — not just the one you received. Re-importing your address later does not undo it.

You can also object without unsubscribing, ask what is held about you, ask for it to be corrected, or ask for it to be erased. Write to the organisation named in the footer of the email, which is the data controller for your details. If you would rather come to us, contact us through the contact page and we will route it — you are entitled to an answer within one month, and you will normally get one far sooner.

If you are unhappy with how a request was handled you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; in Germany it is the supervisory authority for the federal state in which the controller is established.