Theory
Outbound that respects consent
Reaching companies that have never heard of you: whom to contact, on what lawful basis, which data to keep, how to honor an opt-out, and what a good cold message looks like.
~8 min read · 9 exercises · 250 points
Before you start
A list for sale
You're still building Klasna for Teams' pipeline. Veloria came through a contact, and Marta doesn't want to wait for luck in 2027: a vendor offers 5,000 HR managers' emails and mobile numbers for a few thousand hryvnias.
How do you reach companies that have never heard of Klasna without spamming them or breaking data-protection rules?
Outbound prospecting, done well
Outbound prospecting means reaching out first to companies that haven't contacted you. It's a normal part of B2B, especially for a team like Klasna for Teams that can't wait for referrals all year.
Done well, it has four traits: targeted (companies that fit your customer profile), short, relevant to the person's job, and lawful, with an easy way to say no.
A bought list of 5,000 HR managers fails every one:
- you can't show where the data came from or a lawful basis to use it;
- most contacts are companies Klasna would never sell to;
- thousands of unexpected messages bring complaints, and email services start routing all of Klasna's mail to spam, including invoices to real clients.
The problem isn't reaching out. It's reaching out to strangers whose data you can't account for.
- DoTen companies that fit the profile, one relevant person at each.
- Don't5,000 brochures to a bought list on Monday morning.
A work email is personal data
A common belief is that B2B outreach sits outside data protection because it's "only work emails". It doesn't. An address like name.surname@company identifies a person, so it's personal data under the EU's data protection rules (GDPR) and under Ukraine's personal data law.
That means you need a lawful basis to use it. In B2B this is usually consent or a legitimate interest: you weigh your interest in contacting the person against their rights. A message relevant to their job, expected in their role and easy to refuse tends to pass that test.
A guardrail, not legal advice: some countries also require prior consent for marketing email, even to work addresses. Agree the rules of your first campaign with a lawyer once, then follow them every time.
A generic address such as info@ is less personal, but a named person behind it still is.
- Do"Can I explain why I wrote to this person?" asked before every send.
- Don't"It's a work email, so data protection doesn't apply."
Legitimate interest in practice
A legitimate interest isn't a free pass; it's a balance you should be able to explain. Three questions help:
- Is it relevant to the person's job? English for dispatchers, sent to a head of training, is. A course offer sent to a random manager isn't.
- Would they expect it? A work address the company published for training partners invites exactly this contact. A personal mobile from an old conference list doesn't.
- Can they refuse easily? One line on how to stop hearing from you.
Data collected for another purpose fails the second question: addresses that wrote to Klasna support asked for help, not for a newsletter.
So the defensible message is narrow: the right person, through a channel they made public for this, about their work, with an easy way out. The shift in thinking: not "can I find their email?" but "can I explain why I wrote to them?"
- DoA head of training's published partner address, about English for her dispatchers.
- Don'tA newsletter to everyone who ever wrote to support.
They gave their address for another purpose.
Companies first, then one person
Good outbound starts from companies, not addresses. Take the customer profile you already have, such as logistics or IT firms whose staff work with partners in the EU, and list companies that fit it. Only then look for people.
At each company, find the one person whose job this is: usually the head of HR or learning. Reach them through a work address the company published or a professional network profile.
Two common mistakes:
- Going to the top. A note to the CEO of a 300-person firm about English lessons gets forwarded down at best, and you start as the vendor who skipped the right person.
- Writing to ten people at once. Several colleagues comparing identical cold emails looks like spam, and nobody owns the reply.
One relevant person per company, one clear message: fewer sends, more answers.
- DoThe head of training at a Lviv freight firm, via the address on its site.
- Don'tThe same email to the CEO and nine managers of one company.
AI tools in outreach
An AI tool can save hours in outbound: summarising a company's site, suggesting why English might matter to its teams, drafting a first message. Use it for that.
But an AI tool can also state things that aren't true: a wrong office count, a client the company never had, an invented quote. In a first message to a stranger, one false fact ends the conversation and makes the rest of the email look careless.
So the rule is simple: a person checks every fact before anything is sent. Check against the company's own site or a source you can name. If you can't confirm a detail, cut it; a shorter true message beats a longer wrong one.
The same goes for data: don't paste a prospect's personal details into a tool just to "personalise". Keep to what you'd store in the CRM anyway.
- DoCheck the AI's claim about the firm's EU clients on its own site before sending.
- Don'tSend the AI draft as is because it sounds confident.
Data minimisation in the CRM
Once you contact someone, they live in your CRM. The temptation is to save everything you can find "to personalise better". Data minimisation says the opposite: keep only what you need for the purpose.
For a cold prospect that's a short record:
- name and role, so you write to the right person in the right terms;
- company and work email, so you can reach them;
- where and when you found the contact, so you can show the origin of the data if anyone asks.
Leave out what has no business purpose: a date of birth "for a friendly greeting", a personal mobile from an old event list, notes about children from social media. Each extra field is data you must protect and justify, and none of it helps sell English lessons.
A short record is also easier to delete when someone opts out.
- DoName, role, company, work email, "found on company site, 12 Oct".
- Don'tA birthday field "for a friendly greeting".
Opt-outs: at once and for good
When someone says "please don't write to me again", that's final. An opt-out is honoured at once and everywhere: stop the sequence, remove the person from every list and campaign.
Keep only a short suppression entry, such as the email address and the date of the request. It sounds odd, but deleting every trace is riskier: a colleague could import the same contact from another source next month and write again. The suppression list is what prevents that.
What not to do: wait a month and "try a different angle", or have a colleague write from another address. Both ignore a clear no and can turn one annoyed person into a complaint.
A short reply confirming removal is fine; no arguing, no "are you sure?". And every message should make opting out easy from the start: who you are, why you wrote, and one line on how to stop hearing from you.
- Do"Done, I've removed you and won't write again."
One line, then stop.
- Don'tA "last follow-up, just in case" a month later.
Anatomy of a first message
Compare two first emails to a head of training. One fakes an earlier call, invents a deadline, promises productivity "like nothing else" and attaches 24 pages. The other is five plain moves:
- Who you are: "I'm with Klasna for Teams, an online English school for companies."
- Why this person: "Your site lists you as the contact for training partners."
- One relevant problem: freight teams lose time on calls with foreign carriers.
- One small ask: a 20-minute call in the next two weeks.
- How to stop: "Reply 'no' and I won't write again."
Spam signals to avoid: pretending to a conversation that never happened, fake urgency, claims you couldn't prove if asked, a big attachment to a stranger, no way out. Imagine the email forwarded to the reader's boss: would it still look honest?
How it fits together: target companies that fit, write to one relevant person with a lawful basis, keep minimal data, honour every no, send short honest messages. Next lesson: when leads grow, how much did marketing really cause?
- Do"Would a 20-minute call in the next two weeks be useful? If not, reply 'no'."
- Don't"Following up on our call 🙂 LAST CHANCE: 30% off ends Friday!"
There was no call, and the deadline is invented.
Ready to practise?
Answer the lesson's exercises and earn 250 points the first time you finish it.
Start the exercises