Before we contact anyone for you
Your customers trust you. We protect that trust. Before a single message goes out, we go through this checklist with you. If your list doesn't pass, we'll say so and won't use it.
Who's responsible for what
Your business is the controller of your customers' and enquirers' information: you decide who is contacted and why, and you need a lawful reason to contact them. We are your processor: we only use the data on your written instructions, keep it secure, and return or delete it when we finish.
1. Your list
- You know where every contact came fromFor example: an online enquiry form, a phone enquiry, a past appointment. Keep a note of the source and the date.
- Current customers are removedWe focus on people who enquired and never booked, or past customers who are due back, not people you're already looking after.
- Anyone who has asked not to be contacted is removedIncluding anyone who has opted out by phone, email, text or in person. We'll keep a "do not contact" list so they're never contacted again.
- Anyone known to have died is removedPlease check your own records. For larger lists, a bereavement suppression service can help.
- Under-18s are removedWe don't run follow-up campaigns to children.
- Only the details we needFirst name, mobile number and/or email, rough date of last contact, and what they enquired about. Please don't send anything sensitive, such as health notes or test results.
2. Permission to text or email
The rules depend on what the message is.
Messages about an existing booking (no extra permission needed)
Reminders and confirmations for appointments someone has already made are service messages, not marketing. Keep them to the booking and don't add offers.
Messages inviting people to book (marketing rules apply)
Texting or emailing an old enquiry or past customer to invite them in counts as direct marketing under PECR. You can only send it if, for each person, one of these is true:
- They gave clear consentThey ticked a box or said yes to hearing from you by text or email, and you have a record of it.
- Or all four "soft opt-in" conditions are met(1) You got their details when they bought from you or asked about buying, such as asking for a quote or booking an appointment. (2) The message is about your own similar services. (3) They were given a simple chance to opt out when you collected their details. (4) Every message gives an easy way to opt out. We always do (4); you need to be confident about (1) to (3).
If neither is true for someone, or you can't tell, we leave them out. That's the safe choice, and it protects your reputation.
If you're a clinic or health business
A list of clinic patients reveals that people have used a health service, which is sensitive "special category" data under UK GDPR. We keep every message to booking and logistics, never mention test results or conditions, and send nothing that would embarrass someone if a family member saw it. We recommend you record why you're comfortable contacting each group, and consider a short data protection impact assessment (DPIA). We can give you a template.
3. Phone calls
- Numbers are screened against the Telephone Preference Service (TPS)Before any marketing call, unless the person has told you they're happy to be called. Re-screen at least every 28 days.
- Objections are honouredIf someone has asked not to be called, they're not called.
- No recorded or automated marketing callsWe don't make them. Our missed-call text back only replies to someone who has just called you.
4. Paperwork
- A data processing agreement between usWe provide this. It sets out how we protect your data, what we can and can't do with it, and what happens when we finish.
- Your privacy notice is up to dateIt should tell customers you may contact them about appointments and bookings, and that you use trusted service providers to do so.
- Your business is registered with the ICOMost organisations that handle personal data need to pay the ICO data protection fee.
- A DPIA is done for the campaignRecommended if health data is involved, for example for a clinic. We'll help you complete it.
5. How we send (our standards)
- You approve every message firstNothing goes out in your name without your sign-off.
- Sensible hours onlyMonday to Saturday, 9am to 7pm. Never Sundays, early mornings or late evenings.
- Small batchesSo replies get proper attention and nothing feels like a blast.
- Every message has an easy opt-outFor example "Reply STOP". Opt-outs are acted on immediately and shared with you, so you can update your own records.
- Honest about automationIf someone asks whether they're talking to a real person, they're told the truth.
- Sensitive questions go to your teamAnything about health, a complaint, or anyone who seems upset is handed straight to a real person at your business.
6. When we finish
- Your data is returned or deletedWithin the time set in our agreement, except the "do not contact" list, which you keep so those people are never contacted again.
Questions about any of this? Email hq@osix.co.uk and we'll talk it through.