A GDPR cold email tool that checks before it sends

What a GDPR cold email tool can and cannot do

GDPR does not ban B2B cold email, and no software can make an email lawful. The duties sit with you as the sender, and they come in two layers.

GDPR covers the personal data. As a sender you need to:

• Have a lawful basis for contacting each person (Article 6).
• Tell people who you are and where you got their details, unless an exception applies (Article 14).
• Stop using their data for direct marketing when they object (Article 21).
• Keep personal data only as long as you need it (Article 5).
• Handle access and erasure requests (Articles 15 and 17).

National ePrivacy laws then decide whether you may send the email at all. The full GDPR text is on EUR-Lex.

A tool's job is smaller: make the careful path the default, and stop a send when a required step is missing. That is what FoxKnock's built-in GDPR tools do. Whether your outreach is lawful is a judgment only you and your counsel can make. For the legal background, read the GDPR cold email guide.

GDPR B2B outreach: country rules and a lawful basis per contact

Countries do not treat unsolicited B2B email the same way. Each country's own ePrivacy law decides whether you may send, and some are stricter than GDPR's legitimate-interest balancing would suggest. Germany is the best-known example: its unfair competition act asks for prior express consent even for B2B email (see cold email in Germany under the UWG).

FoxKnock handles this with country rule packs. Each country is set to one of three modes: allow, require a confirmed lawful basis, or block. These are the defaults:

You can edit every rule and block any country outright. Review the defaults for the markets you actually sell into. An allow default is not a blanket yes: in the UK, for example, sole traders and some partnerships count as individuals under PECR, and the ICO's business-to-business marketing guidance says to treat unclear cases as individuals.

FoxKnock reads a contact's country from the contact record, then the company, then the country suffix of the email domain. If none of those resolves, the country is unknown.

Illustration: you import three contacts, one in France, one in Germany and one whose country FoxKnock cannot resolve. The French contact passes the country rule. The German contact waits until someone confirms a lawful basis. The third is blocked until you set a country or a basis.

The lawful basis on each contact

Each contact carries a lawful basis: legitimate interest, consent or contract. In a country that requires one, the contact cannot be enrolled until someone has confirmed it. FoxKnock accepts any of the three as that confirmation, so whether the basis you pick is valid in that country is your call.

Only admins can record consent, and every change is written to the contact's timeline and the audit log. A contact who confirms their email through a FoxKnock form with follow-ups switched on is recorded with the basis consent.

Legitimate interest cold email: write the assessment once

Legitimate interest rests on a written assessment. FoxKnock keeps one per workspace in the compliance settings, with a starter template, rather than a note on each contact.

Keep it short and specific. It should answer three questions:

• Why are the roles you target relevant to your offer?
• Why is contacting them necessary for that purpose?
• Why do their interests not outweigh yours?

Recital 47 says direct marketing may be regarded as a legitimate interest, but "may" is not "always". The written assessment is your record if anyone asks, and an objection to direct marketing must still be honored.

Article 14 notice cold email: the privacy link in your first touch

When you find a work email in a database or on the web, you did not collect it from the person. Article 14 then generally requires you to tell them who you are, why you hold their details and where those details came from. If you use the data to contact them, that has to happen at the latest at your first message.

FoxKnock adds a link to your privacy notice to first-touch emails:

• The setting is on by default and needs your notice URL.
• While it is on, a missing link blocks first touches to recipients in the EU, EEA, UK, Switzerland or an unknown country.
• You can switch it off, and then neither the link nor the block applies. That is your decision and your responsibility.

You supply the URL and you write the notice. FoxKnock does not draft it and cannot judge whether it is adequate.

Enriched fields also record where they came from: the provider, the source URL where there is one, a confidence score and the time of retrieval. That is the raw material for answering "where did you get my details?".

What every email carries

• A one-click unsubscribe link and the matching List-Unsubscribe headers (RFC 8058).
• Your postal address, which is required before any real email is sent.
• Optionally, a line saying the message was drafted with AI assistance. It is off by default and added only to AI-written messages.

FoxKnock does not track email opens or clicks: it adds no tracking pixel and wraps no links.

Suppression: how objections and unsubscribes are honored

An objection to direct marketing has to be honored (Article 21), so suppression is checked more than once. One list per workspace holds addresses and whole domains, each with a reason: unsubscribed, bounced, complained, manual, GDPR objection, competitor or customer. It is checked at enrollment, when a step is prepared and again at the moment of sending, so a person who objects after enrollment is still caught.

Addresses reach the list in four ways:

• A click on the unsubscribe link.
• A reply that the AI inbox recognizes as an unsubscribe request, with enough confidence. This is on by default.
• By hand, with any of the reasons above.
• By importing an existing do-not-contact list from CSV.

You can export the list at any time.

Illustration: a prospect phones your office and asks you to stop. You add their address by hand with the reason GDPR objection, and any step already queued for them is checked against the list at the moment of sending.

Data access, erasure and retention

Retention

Prospect data you never use is easy to forget. FoxKnock's retention setting deletes prospects you never contacted and who never engaged, 365 days after they were added by default.

• The window is fixed, not rolling, so editing a record does not reset it.
• Anyone who has been sent a message, has replied, has been enrolled, has a meeting or an open task, or works at a customer account is left alone.
• Suppression entries are never deleted.
• Set the window to 0 to switch retention off.

Access and erasure requests

For access requests (Article 15), an admin can look up one email address, see everything the workspace holds about that person and export it as JSON.

For erasure (Article 17), one action:

• adds the address to the suppression list with the reason GDPR objection,
• cancels unsent emails to them,
• deletes the contact and the records attached to it,
• redacts message content,
• and scrubs transcripts, notifications and queued webhooks.

The audit log keeps only a hash, and a hashed marker stops the same person from being imported again. Copies already pushed to a connected CRM are outside FoxKnock's reach, so remove those yourself.

Where the data lives

The app, background workers and PostgreSQL database run on a Hetzner Cloud server in Nuremberg, Germany. That is not the same as every step staying in the EU, because AI features send content to Claude, by Anthropic, and lookups call the data providers. The security page describes the setup, including what has not been done yet.

Checks inside the tool versus a spreadsheet

If your lead data, your sending tool and your do-not-contact list sit in separate tools, the checks can depend on someone exporting one list and importing it into another. A lawful basis or a source may live in a spreadsheet, if anywhere.

FoxKnock keeps those in one workspace and enforces them at enrollment and at send. The checks run on the data in your workspace, so a wrong country or a missing source is not caught by them. FoxKnock cannot replace a lawyer or a data protection officer, and it will not decide whether legitimate interest holds for your campaign.

What it costs and how to try it

The compliance tools are part of the product, not a paid add-on, and none of them appears in the credit price table at default prices. You pay credits for the work around them, such as finding an email or drafting an AI-personalized message, with the cost shown before you commit.

Plans start at Free ($0, with 500 one-time credits), then Starter at $49 a month with 5,000 credits. The pricing page lists sequences, where the send-time checks run, from Starter. Credit prices can change, so check the pricing page.

To see how the rules apply to your own market, start free, use the free credits to build a small list and review the country rules in the compliance settings.